• Task
  • Version · 6.0
  • Deliver

SqlGrantOptionWarn

Last updated: July 13, 2026

This check warns a user when SQL contains 'GRANT' statements that include the 'WITH GRANT OPTION' clause so that they can ensure that the privilege being granted won't lead to security issues or violate compliance regulations.

Uses

Property

Value

Liquibase version required

4.6.0+

Scope (--checks-scope)

changelog

Default status

enabled

Default severity (exit code)

0 ("INFO")

Customizable settings

No (static)

Use the check to warn when changelogs contain WITH GRANT OPTION statements. Unintended or unauthorized GRANTS can lead to security and compliance issues, especially in regulated industries. This policy check alerts users so they can exercise more control over privileges and permission changes, which is especially important in automated data pipelines, before these changes are deployed to your policy checked environments.

Note: SqlGrantOptionWarn only supports unmodeled changeset types. If you use this Policy Check with modeled changesets (XML, JSON, and YAML changelogs as well as all ChangeTypes except sql and sqlFile), a message will appear stating the changeset was skipped.

Before you begin

  1. Ensure that the --checks-scope parameter includes the scope of this check.

    Changelog checks prerequisites

    loading

    loading

    loading

    loading

    loading

Procedure

1

Enable

This check is enabled by default. To verify that it is currently enabled, run the checks show command:

liquibase checks show --check-name=<string>

2

To run the check, use the checks run command.

loading

loading

Note: For flow files you'll need to run liquibase flow to apply your changes.

Example output

Short Name

Category

Description

Customization

Status

Severity

Scope

Type

SqlGrantOptionWarn

Authorization and Access

Detects WITH GRANT OPTION statements, which allows the recipient to pass permissions on to other users, helping you prevent privilege escalation security risks which could spread beyond intended recipients.

<None>

enabled

0

changelog

sql, xml, yaml, json

Liquibase command 'checks show' was executed successfully.

PreviousSQLGrantAdminWarnNextSqlGrantSpecificPrivsWarn